@ecomconsult/consentkit 0.5.12 → 0.5.13

package/README.md

@@ -29,7 +29,7 @@ Vanilla ES2020, zero dependencies, no build step.
 - **Equal-weight buttons, no pre-ticked boxes** — the consent invariants are
   fixed by design, see [CONTRIBUTING.md](https://github.com/vermoh/ConsentKit/blob/main/CONTRIBUTING.md)
 
-> **Status: prototype (v0.5.12).** The core, the UI and the demo are verified in
+> **Status: prototype (v0.5.13).** The core, the UI and the demo are verified in
 > a browser and covered by an automated suite (`npm test`); several distribution
 > paths are not yet tested against live systems. See
 > [Project status](#project-status) before shipping this to production.
@@ -819,7 +819,7 @@ external requests. Rebuild them with `tools/build-inline.mjs` (see
 [`tools/README.md`](https://github.com/vermoh/ConsentKit/blob/main/tools/README.md)); each block's header records the exact
 command that produced it.
 
-ConsentKit 0.5.12, rebuilt 2026-09-07, uncompressed — gzip on the server cuts
+ConsentKit 0.5.13, rebuilt 2026-09-07, uncompressed — gzip on the server cuts
 this roughly threefold. Every block includes the branding extension and the
 attribution line; `--no-branding` drops both the code and the config and takes
 **~26 KB** back off:
@@ -1023,6 +1023,10 @@ Client versions. The WordPress plugin tracks the same numbers and keeps its own
 notes in
 [`plugins/wordpress/consentkit/readme.txt`](https://github.com/vermoh/ConsentKit/blob/main/plugins/wordpress/consentkit/readme.txt).
 
+### 0.5.13
+
+- Host database: `fbcdn.net` → marketing (Facebook SDK chunks and plugin images); `aichat.md`, `bubble.aichat.md` → functional (chat widget); `challenges.cloudflare.com` (Cloudflare challenge / Turnstile) and `i.imgur.com` → infrastructure, never held.
+
 ### 0.5.12
 - **Services in the preferences panel are collapsed by default and compact.**
   The group's «N services · M cookies» line became a disclosure button; opening
@@ -1139,7 +1143,7 @@ notes in
 
 ## Project status
 
-**This is a prototype (v0.5.12), not a released product.** It is honest about
+**This is a prototype (v0.5.13), not a released product.** It is honest about
 what has been verified and what has not.
 
 ### Verified

package/npm/internal-stub.mjs

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.5.12',
+    version: '0.5.13',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.5.12",
+  "version": "0.5.13",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",

package/src/ck-core.js

@@ -92,6 +92,7 @@
 
     // --- marketing -----------------------------------------------------
     'connect.facebook.net': 'marketing',
+    'fbcdn.net': 'marketing',                 // Facebook CDN: SDK chunks (static.xx) and plugin images (scontent.*)
     'facebook.net': 'marketing',              // connect.facebook.net covered above
     'analytics.tiktok.com': 'marketing',
     'googleadservices.com': 'marketing',
@@ -205,6 +206,7 @@
     // Booking and form embeds — the visitor came to the page to use them.
     'calendly.com': 'functional',
     'typeform.com': 'functional',
+    'aichat.md': 'functional',                // aichat.md chat widget (bubble.aichat.md loader)
     // 999.md — the Moldovan classifieds platform. Shops embed its listing
     // widgets; simpalsmedia.com is the group's asset host that serves them.
     '999.md': 'functional',
@@ -432,6 +434,9 @@
   // places is classified, not waved through — so a bare `cloudflare.com` here
   // would be a bug.
   var INFRA_DB = [
+    // --- bot checks and image hosts: not a consent decision -------------
+    'challenges.cloudflare.com',           // Cloudflare challenge / Turnstile (incl. *.challenges.cloudflare.com)
+    'i.imgur.com',                          // hot-linked images
     // --- site builders and hosting platforms ---------------------------
     'tildacdn.com',
     'tildacdn.net',
@@ -1973,7 +1978,7 @@
   // Public API
   // ---------------------------------------------------------------------------
   var ConsentKit = {
-    version: '0.5.12',
+    version: '0.5.13',
     config: config,
 
     init: function (userConfig) {